CVE-2026-6089: 
WordPress vulnerability analysis and mitigation

CVE-2026-6089 is a Server-Side Request Forgery (SSRF) vulnerability in the WP CTA – Call Now Button, Sticky Button & Call to Action Builder plugin for WordPress, developed by blendmedia. It affects all versions up to and including 2.1.2, and was published on July 29, 2026. The flaw allows authenticated attackers with Administrator-level access to make arbitrary web requests from the server and read the full response content via saved WordPress media attachments. It carries a CVSS v3.1 base score of 4.9 (Medium) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and originates in the import_sidebars() function within inc/import-export.php. When processing imported JSON files, the function passes user-supplied URLs from the sticky_s_media parameter directly to PHP's file_get_contents(), relying solely on FILTER_VALIDATE_URL for validation — a check that does not block internal or private IP addresses. The fetched response content is then saved as a WordPress media attachment, creating a full-read SSRF where the attacker can retrieve and exfiltrate the response from any reachable internal endpoint (GitHub Advisory, WordPress Trac).

Successful exploitation enables an authenticated administrator-level attacker to perform reconnaissance against internal infrastructure by issuing server-side HTTP requests to arbitrary internal IP addresses and services. Because the full response body is saved as a WordPress media attachment and is thus retrievable by the attacker, this constitutes a full-read SSRF with high confidentiality impact. Integrity and availability are not directly affected, but the ability to probe internal services could facilitate lateral movement or further attacks against cloud metadata endpoints, internal APIs, or other sensitive resources (GitHub Advisory, Wordfence).

1. Gain Administrator Access: Obtain WordPress administrator credentials through phishing, credential stuffing, or another means, as the vulnerability requires Administrator-level authentication.
2. Prepare Malicious JSON File: Craft a JSON file intended for import into the WP CTA plugin, embedding a malicious URL in the sticky_s_media parameter pointing to an internal target (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata, or an internal service IP).
3. Import the JSON File: Navigate to the WP CTA plugin's import/export functionality in the WordPress admin panel and upload the crafted JSON file, triggering the import_sidebars() function.
4. Trigger SSRF: The import_sidebars() function passes the attacker-controlled URL to file_get_contents(), which fetches the content of the internal resource. The FILTER_VALIDATE_URL check is bypassed since internal IPs are syntactically valid URLs.
5. Retrieve Response: The fetched response content is saved as a WordPress media attachment. The attacker accesses the WordPress media library or directly retrieves the attachment URL to read the full response from the internal service (GitHub Advisory, WordPress Trac).

• Logs: WordPress access logs showing POST requests to the plugin's import endpoint (e.g., wp-admin/admin-ajax.php or plugin-specific import pages) with JSON payloads containing internal IP addresses or cloud metadata URLs in the sticky_s_media field.
• File System: Unexpected media attachments in the WordPress uploads directory (wp-content/uploads/) containing raw HTTP response data from internal services, cloud metadata endpoints, or other non-image/non-media content.
• Network: Outbound HTTP requests from the web server process to internal RFC 1918 addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) or cloud metadata endpoints (e.g., 169.254.169.254) initiated by the PHP process.
• WordPress Activity: Audit log entries (if a logging plugin is active) showing administrator-level JSON import operations, particularly from unfamiliar IP addresses or at unusual times.

A patch has been released for the WP CTA plugin; administrators should update to a version newer than 2.1.2 immediately by applying the changeset available in the WordPress plugin repository (WordPress Trac Changeset). As interim mitigations, restrict Administrator-level access to trusted users only, and implement network-level controls (e.g., egress firewall rules) to prevent the web server from making outbound requests to internal IP ranges or cloud metadata endpoints. Additionally, review and audit any previously imported JSON files for suspicious URLs in the sticky_s_media field (Wordfence).